WO2019242052A1 - 一种针对HTTP Flood攻击的防护方法及装置 - Google Patents

一种针对HTTP Flood攻击的防护方法及装置 Download PDF

Info

Publication number
WO2019242052A1
WO2019242052A1 PCT/CN2018/095433 CN2018095433W WO2019242052A1 WO 2019242052 A1 WO2019242052 A1 WO 2019242052A1 CN 2018095433 W CN2018095433 W CN 2018095433W WO 2019242052 A1 WO2019242052 A1 WO 2019242052A1
Authority
WO
WIPO (PCT)
Prior art keywords
protection
server
detection information
strategy
sent
Prior art date
Application number
PCT/CN2018/095433
Other languages
English (en)
French (fr)
Inventor
马涛
杨光
Original Assignee
网宿科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 网宿科技股份有限公司 filed Critical 网宿科技股份有限公司
Priority to EP18877315.4A priority Critical patent/EP3618395B1/en
Priority to US16/340,826 priority patent/US20210367967A1/en
Publication of WO2019242052A1 publication Critical patent/WO2019242052A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/168—Implementing security features at a particular protocol layer above the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the invention relates to the technical field of computer network security, and in particular, to a method and a device for protecting against HTTP Flood attacks.
  • Hypertext Transfer Protocol Flood (HTTP, Flood) attacks are a way of attacking servers.
  • the protection method for HTTP Flood attacks is to set a protective device between the client and the server. After the client and the server establish a Transmission Control Protocol (TCP) connection, the client can send HTTP requests to the server to protect the server. After the device obtains the HTTP request, the device uses a preset protection policy to verify the HTTP request, and sends the HTTP request to the server after the verification is passed, otherwise it intercepts it to prevent the attacker from sending the HTTP request to attack the server.
  • TCP Transmission Control Protocol
  • the attack programs configured on some attack ends have been able to analyze general protection strategies, thereby breaking through some simple protection strategies.
  • the attacker will also analyze the effect of the attack. When the effect is not good, it will increase the intensity and type of the attack in order to break the current protection strategy.
  • the protection policy needs to be configured in advance.
  • the protection policy configured in advance is either too loose and the protection effect is not good, or too strict and it affects normal user requests. .
  • operation and maintenance personnel need to adjust their policies for different attack methods. The timeliness is very poor, and effective protection policies cannot be issued in time, resulting in business interruption due to attacks.
  • the maintenance strategy adopted by the operation and maintenance personnel for the current attack cannot evaluate whether it is effective, so it is necessary to pay attention to the status of the attack and protection and the impact on the requests of normal users from time to time, and the operation and maintenance is very difficult.
  • embodiments of the present invention provide a method and a device for protecting against HTTP flood attacks.
  • the technical solution is as follows:
  • a method for protecting against HTTP flood attacks includes:
  • the second protection strategy is used for protection, and the protection level of the second protection strategy is higher than that of the first protection strategy.
  • detecting the protection performance of the first protection strategy includes:
  • detecting the protection performance of the first protection strategy includes:
  • detecting the protection performance of the first protection strategy includes:
  • the detection information is sent to the server according to a preset period.
  • the response information sent by the server based on the detection information is not received within a preset period of time, it is determined that the protection performance of the first protection strategy does not meet requirements.
  • the detection information is preset detection information
  • the method further includes:
  • the server When the server is in a service state, the server obtains pre-stored response information after receiving the preset detection information;
  • the sending the detection information to the server according to a preset period further includes:
  • the source address of the target HTTP request is replaced with the IP address of the protective device according to a preset period, and detection information carrying the IP address of the protective device is obtained.
  • the target HTTP request is any one of the HTTP requests sent by the client. Request for verification;
  • the method includes:
  • the method further includes:
  • the protection is stopped.
  • a protection device against HTTP Flood attacks includes:
  • a detection unit configured to detect the protection performance of the first protection strategy when the first protection strategy is used for protection
  • a protection unit is configured to use a second protection strategy for protection when the protection performance of the first protection strategy does not meet requirements, and the protection level of the second protection strategy is higher than that of the first protection strategy.
  • the detection unit is specifically configured to count the number of HTTP requests sent to the server within a predetermined time interval
  • the protection unit is specifically configured to determine that the protection performance of the first protection strategy does not meet requirements when the number of HTTP requests sent to the server is greater than a first threshold.
  • the detection unit is further configured to count the HTTP request traffic sent to the server within a predetermined time interval
  • the protection unit is further configured to determine that the protection performance of the first protection policy does not meet requirements when the HTTP request traffic sent to the server is greater than a preset traffic.
  • the detection unit is further configured to send detection information to the server according to a preset period
  • the protection unit is further configured to determine that the protection performance of the first protection strategy does not meet requirements when no response information sent by the server based on the detection information is received within a preset period of time.
  • the detection information is preset detection information
  • the detection unit is further configured to receive pre-stored response information sent by the server based on the preset detection information when the server is in a service state.
  • the detection unit is further configured to replace the source address of the target HTTP request with the IP address of the protection device according to a preset period, and obtain detection information carrying the IP address of the protection device, and the target HTTP request Sending a verified request for any one of the HTTP requests sent by the client; sending the detection information to the server.
  • the detecting unit is further configured to, when receiving the response information sent by the server based on the detection information, replace the destination address in the response information with the source address in the target HTTP request; And sending the response information after the destination address is changed.
  • the protection unit is further configured to count the number of HTTP requests received within each predetermined time interval; when the number of HTTP requests received within the predetermined time interval is greater than a second threshold, use the The first protection strategy performs protection; when the number of HTTP requests received within a preset preset number of consecutive time intervals is not greater than the second threshold, the protection is stopped.
  • a protection device includes a processor and a memory.
  • the memory stores at least one instruction, at least one program, code set, or instruction set.
  • the at least one instruction, the at least one A program, the code set, or the instruction set is loaded and executed by the processor to implement the protection method described in the first aspect.
  • the method and device for protecting against HTTP flood attacks provided by the embodiments of the present invention can automatically detect attack methods and protection effects, and automatically adjust the protection strategy used for different attack methods, which can improve the protection effect and Can greatly reduce the impact on the user's normal use, and good timeliness.
  • FIG. 1 is a schematic diagram of a system framework according to an embodiment of the present invention
  • FIG. 2 is a flowchart of a method for protecting against HTTP flood attacks according to an embodiment of the present invention
  • FIG. 3 is a flowchart of another method for protecting against HTTP flood attacks according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a protection device against HTTP flood attacks according to an embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a protective device according to an embodiment of the present invention.
  • An embodiment of the present invention provides a method for protecting against HTTP Flood attacks.
  • This method can be applied to the system framework shown in FIG. 1.
  • the system framework includes clients, protective equipment, and servers.
  • the client is connected to the protective device, and the protective device is connected to the server.
  • Clients include normal clients and attackers.
  • the server can be a server cluster.
  • the protection device receives and verifies the HTTP request sent by the client to the server, protects and filters malicious requests, and normal requests are forwarded to the server.
  • the protection device may not perform protection, that is, after receiving the HTTP request, it is not necessary to verify the security of the HTTP request, but directly sends the HTTP request to the server.
  • the process for the protection device to determine whether there is an attack is to determine the number of HTTP requests received within each predetermined time interval (for example, 5 seconds). When the number of HTTP requests received within any predetermined time interval exceeds the threshold, the first When the threshold is two, it can be considered that there is an attack, otherwise it can be considered that there is no attack.
  • each predetermined time interval may be continuous in time, that is, the end time of the last predetermined time interval is the start time of the next predetermined time interval, and each predetermined time interval may also be in time. Is discontinuous.
  • the process of protection equipment protection includes: receiving the HTTP request sent by the client, parsing the received HTTP request, and when the HTTP request does not contain authentication information, sending data to the client for obtaining the authentication information, the client receives After the data is obtained, the authentication information corresponding to the data is obtained, and the HTTP request containing the authentication information is re-sent to the protective device.
  • the protective device parses out the authentication information in the HTTP request and verifies it, and then passes the verification to the server. Send the HTTP request.
  • the attacker is generally only responsible for sending a large number of HTTP requests without receiving the authentication information sent by the protection device or parsing after receiving, so it cannot send a new HTTP request with authentication information.
  • the HTTP request authenticated by the device is a malicious request sent by the attacker and will be discarded without being forwarded to the server.
  • the HTTP request authenticated by the protective device is a normal request and will be forwarded to the server through the protective device, so the protective device can intercept the attack
  • the HTTP request sent by the attacker prevents the malicious request from the attacker from affecting the server.
  • the protection device stores a protection policy set, and the protection policy set includes at least two protection levels of protection policies, such as a 302 jump verification protection strategy, a JavaScript script verification protection strategy, or a picture verification protection strategy.
  • the protection strategy can be divided into protection levels according to how easy it is for an attacker to crack the protection strategy.
  • the protection strategy of 302 jump verification the data sent by the protection device carries verification information, so the verification information can be obtained directly from the data.
  • the protection strategy of JavaScript script verification it needs to be performed according to the program in the script. Corresponding calculation can generate verification information, and it is more difficult for the attacker to crack the protection strategy of javascript script verification.
  • the protection level of javascript script verification is higher than that of 302 jump verification.
  • For the protection strategy of picture verification users need to input verification information based on pictures, and its protection level is higher.
  • the default protection policy can be used for protection, for example, the protection policy with the lowest protection level is used.
  • the current protection strategy is used for protection and the server is still under attack, you can use a higher protection strategy than the current protection level for protection. The following describes this process in detail.
  • FIG. 2 is a flowchart of a method for protecting against HTTP flood attacks according to an embodiment of the present invention.
  • the method is specifically applied to a protection device, that is, executed by the protection device.
  • the method may include the following steps.
  • Step 201 When the first protection strategy is used for protection, the protection performance of the first protection strategy is detected.
  • the first protection policy may be any protection policy in a protection policy set.
  • Step 202 When the protection performance of the first protection strategy does not meet requirements, use a second protection strategy for protection, and the protection level of the second protection strategy is higher than that of the first protection strategy.
  • the protection performance or protection effect of the first protection strategy currently used may be detected, and when the protection performance of the first protection strategy does not meet requirements, Switch to a higher protection level protection strategy to achieve automatic adjustment of the protection strategy.
  • This embodiment of the present invention provides two ways to detect the protection performance of the first protection strategy.
  • Detection method 1 Count the number or traffic of HTTP requests sent to the server within a predetermined time interval.
  • the attacking end sends a large number of malicious requests when attacking the server.
  • these malicious requests cannot be detected, and they are mistakenly considered as legitimate HTTP requests.
  • Detection method 2 Send detection information to the server according to a preset period. When no response information sent by the server based on the detection information is received within a preset period of time, it is determined that the protection performance of the first protection policy is not satisfied. Claim.
  • the protection device can be protected by using detection method 1 and detection method 2 at the same time, or one of the detection methods can be used for protection alone.
  • the protection strategy used can be upgraded multiple times.
  • the protection strategy can be upgraded whenever it is found that the protection performance of the current protection strategy does not meet the requirements.
  • the currently used protection strategy is the 302 jump verification protection strategy.
  • the server still receives the attack, then continue to upgrade and use the image verification protection strategy for protection.
  • Each protection strategy in the protection strategy set can be sorted according to the protection level. Whenever the protection strategy is upgraded, a protection strategy higher than the current protection strategy can be used. If the current protection strategy is the highest protection level, you can continue to detect the service status of the server. When it is detected that the server is not in the service state, it means that the protection strategy with the highest protection level cannot protect the current attack, which can further improve the protection strategy. Degree of protection.
  • the protection device When the protection device performs protection, it can count the number of HTTP requests received in each predetermined time interval. When the number of HTTP requests received in a preset number of consecutive predetermined time intervals is not greater than the second threshold, it means that There is no attack and you can stop protection.
  • the first threshold and the second threshold in the embodiment of the present invention may be equal to or different from each other, and are not specifically limited herein.
  • FIG. 3 it is a flowchart of a method for protecting against HTTP flood attacks according to an embodiment of the present invention.
  • the method is specifically applied to a protection device, that is, executed by the protection device.
  • the method may include the following steps.
  • Step 301 The protection device uses the first protection strategy for protection, and sends detection information to the server according to a preset period.
  • the protection device When there is an attack, that is, when the protection device starts to protect, it can send detection information to the server according to a preset period to detect whether the server is in a service state, and determine the protection effect of the current protection strategy against the current attack based on the server's service state. .
  • the protection device When the protection device is in the protection state, the service status of the server can be continuously detected until the protection is stopped.
  • Step 302 When the response information sent by the server based on the detection information is not received within a preset period of time, the protection device uses a second protection policy for protection, and the protection level of the second protection policy is higher than A protection level of the first protection strategy.
  • the server can receive the detection information from the protection device and send a response message to the protection device based on the detection information; and when the server is under attack and not in the service state, the server cannot receive the protection information
  • the detection information sent by the device, or the response information cannot be sent to the protective device based on the detection information, and the protective device cannot receive the response information.
  • the protective device did not receive the response message including the case where no information was received, and also the case where the error message was received.
  • the detection information sent by the protective device to the server in two ways can be described separately below.
  • the protection device sends preset detection information to the server according to a preset period, that is, the detection information sent by the protection device is the same each time.
  • the preset detection information may be a complete HTTP request, or may include only a request header in the HTTP request.
  • the detection information used may only be recognized by the server, and the format of the detection information is not specifically limited here.
  • Response information corresponding to the detection information is pre-stored in the server. In other words, the detection information corresponds to a fixed page, and the page can be accessed using a fixed domain name.
  • the server When the server is in a service state, after receiving the preset detection information, the server obtains pre-stored response information, and then sends the response information to the protective device. After receiving the response information, the protection device can determine that the server is in a normal service state. When the response information sent by the server based on the detection information is not received within a preset time period, it can be determined that the server is not in a service state, and the current protection policy can be upgraded to a higher-level protection policy.
  • the server may not pre-store the response information corresponding to the detection information, and the detection information may be a complete HTTP request, and the server may perform a normal response service based on the HTTP request, thereby sending the response information to the protective device.
  • This response service is similar to the response service based on the HTTP request sent by the client.
  • the protective device replaces the source address of the target HTTP request with the Internet Protocol (IP) address of the protective device according to a preset period, and uses the HTTP request carrying the IP address of the protective device as detection information, and the target HTTP request Any authenticated request from the HTTP request sent by the client.
  • IP Internet Protocol
  • the protection device sends the detection information to the server.
  • the server can perform a normal response service according to the HTTP request, and send a response message to the protection device.
  • the protection device replaces the destination address in the response information with the source address in the target HTTP request, and sends The response information after the destination address is changed.
  • the HTTP request sent by the client is used as detection information after changing the source address, so that the server sends response information to the protection device according to the detection information.
  • the protection device After the protection device receives the response information, it then changes the target address to enable the client.
  • the response information is received, so that it can detect whether the server is in a service state without affecting the normal access of the client, and it will not increase the burden on the server by periodically sending additional detection information.
  • the method for protecting against HTTP Flood attacks can automatically detect the attack method and the protection effect, and can automatically adjust the protection strategy used for different attack methods, that is, the default protection level is used.
  • the protection strategy performs protection. When it is detected that the current protection strategy is not enough to protect the current attack and the protection effect is not good, the current protection strategy will be adaptively upgraded to a higher level protection strategy until it can resist the current attack. In this way, the protection effect can be improved, and the impact on the normal use of the user can be greatly reduced, and the timeliness is good.
  • FIG. 4 it is a schematic structural diagram of a protection device against HTTP flood attacks according to an embodiment of the present invention.
  • the device may be configured in a protection device or the protection device itself.
  • the device may include a detection unit 401 and a protection unit 402.
  • the detection unit 401 is configured to detect the protection performance of the first protection strategy when the first protection strategy is used for protection.
  • the protection unit 402 is configured to use a second protection strategy for protection when the protection performance of the first protection strategy does not meet requirements, and the protection level of the second protection strategy is higher than that of the first protection strategy.
  • the detection unit 401 is specifically configured to count the number of HTTP requests sent to the server within a predetermined time interval; and the protection unit 402 is specifically configured to determine when the number of HTTP requests sent to the server is greater than a first threshold The protection performance of the first protection strategy does not meet requirements.
  • the detection unit 401 is further configured to count the HTTP request traffic sent to the server within a predetermined time interval; and the protection unit 402 is further configured to determine when the HTTP request traffic sent to the server is greater than a preset traffic.
  • the protection performance of the first protection strategy does not meet requirements.
  • the detection unit 401 is further configured to send detection information to the server according to a preset period; and the protection unit 402 is further configured to send the detection information based on the detection information when the server is not received within a preset time period When the response information is determined, it is determined that the protection performance of the first protection strategy does not meet requirements.
  • the detection information is preset detection information; the detection unit 401 is further configured to receive pre-stored response information sent by the server based on the preset detection information when the server is in a service state .
  • the detection unit 401 is further configured to replace the source address of the target HTTP request with the IP address of the protection device according to a preset period, and obtain detection information carrying the IP address of the protection device, and the target HTTP request Any authenticated request in the HTTP request sent by the client; sending the detection information to the server.
  • the detection unit 401 is further configured to, when receiving response information sent by the server based on the detection information, replace the destination address in the response information with the source address in the target HTTP request; And sending the response information after the destination address is changed.
  • the protection unit 402 is further configured to count the number of HTTP requests received within each predetermined time interval; when the number of HTTP requests received within a preset number of consecutive predetermined time intervals is not greater than the second threshold value Stop protection.
  • the protection unit 402 is further configured to count the number of HTTP requests received in a predetermined time interval; when the number of HTTP requests received in the predetermined time interval is greater than a second threshold, use the first Protection strategy for protection.
  • the protection device for HTTP Flood attacks provided by the embodiments of the present invention can automatically detect the attack method and the protection effect, and automatically adjust the protection strategy used for different attack methods, which can improve the protection effect and can also Greatly reduce the impact on the normal use of users, and good timeliness.
  • the protection device for HTTP Flood attacks provided by the above embodiments only uses the division of the above functional units as an example for illustration. In practical applications, the above functions can be assigned to different functions as required. The unit is completed, that is, the internal structure of the device is divided into different functional units to complete all or part of the functions described above.
  • the protection device for the HTTP Flood attack provided by the foregoing embodiment belongs to the same concept as the embodiment for the protection method for the HTTP Flood attack, and its specific implementation process is detailed in the method embodiment, which is not described again here.
  • the protection device 500 may have a relatively large difference due to different configurations or performance, and may include one or more central processing units 522 (for example, one or more processors) and a memory 532, one or more storage applications 542, or The storage medium 530 of the data 544 (for example, one or one storage device in Shanghai).
  • the memory 532 and the storage medium 530 may be temporary storage or persistent storage.
  • the program stored in the storage medium 530 may include one or more units (not shown in the figure), and each unit may include a series of instruction operations on the protective equipment.
  • the central processing unit 522 may be configured to communicate with the storage medium 530 and execute a series of instruction operations in the storage medium 530 on the protection device 500.
  • the protective device 500 may also include one or more power sources 529, one or more wired or wireless network interfaces 550, one or more input / output interfaces 558, one or more keyboards 554, and / or, one or more operating systems. 541, such as Windows ServerTM, Mac OSXTM, UnixTM, LinuxTM, FreeBSDTM and so on.
  • the protective device 500 may include a memory, and one or more programs, one or more programs stored in the memory, and configured to be executed by one or more processors.
  • the one or more programs include for performing Instructions for the above protection methods.
  • the program may be stored in a computer-readable storage medium.
  • the storage medium mentioned may be a read-only memory, a magnetic disk or an optical disk.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Environmental & Geological Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本发明公开了一种针对 HTTP Flood 攻击的防护方法及装置，该方法包括：当使用第一防护策略进行防护时，检测所述第一防护策略的防护性能；当所述第一防护策略的防护性能不满足要求时，使用第二防护策略进行防护，所述第二防护策略的防护等级高于所述第一防护策略的防护等级。本发明实施例提供的针对 HTTP Flood 攻击的防护方法及装置，能够自动的对攻击方式及防护效果进行检测，并针对不同的攻击方式对使用的防护策略进行自动调整，既能够提升防护效果，又能够较大程度地降低对用户正常使用的影响，并且及时性好。

Description

一种针对HTTP Flood攻击的防护方法及装置 技术领域
本发明涉及计算机网络安全技术领域，特别涉及一种针对HTTP Flood攻击的防护方法及装置。
背景技术
超文本传输协议洪水(Hyper Text Transfer Protocol Flood，HTTP Flood)攻击是一种主要针对服务器进行攻击的方式。目前，针对HTTP Flood攻击的防护方法是在客户端与服务器中间设置一防护设备，当客户端与服务器建立传输控制协议(Transmission Control Protocol，TCP)连接后，客户端可以向服务器发送HTTP请求，防护设备在获取到所述HTTP请求后，采用预设的防护策略对HTTP请求进行验证，验证通过后向服务器发送HTTP请求，否则进行拦截，从而防止攻击端发送HTTP请求攻击服务器。
随着攻防对抗的演进，在有些攻击端上配置的攻击程序已经能够针对一般性的防护策略进行分析，从而突破了一些简单的防护策略。同时，攻击端在攻击过程中，也会分析攻击效果，当效果不好时，会提升攻击的强度和攻击类型，以便突破当前的防护策略。
通常，防护策略需要事先配置，而对于配置管理员来讲，由于无法预测攻击的强度和类型，因此事先配置的防护策略要么过于宽松而导致防护效果不好，要么过于严格而导致影响正常用户请求。当受到不同强度和类型的攻击时，运维人员需要针对不同的攻击方式进行策略的调整，及时性很差，无法及时下发行之有效的防护策略，从而造成业务因攻击而中断。并且在防护过程中，运维人员针对当前攻击所采用的防护策略，无法评估其是否有效，因此需要时时关注攻击和防护的状态以及对正常用户的请求的影响，运维难度非常大。
发明内容
为了解决现有技术的问题，本发明实施例提供了一种针对HTTP Flood攻击 的防护方法及装置。所述技术方案如下：
第一方面，提供了一种针对HTTP Flood攻击的防护方法，所述方法包括：
当使用第一防护策略进行防护时，检测所述第一防护策略的防护性能；
当所述第一防护策略的防护性能不满足要求时，使用第二防护策略进行防护，所述第二防护策略的防护等级高于所述第一防护策略的防护等级。
可选的，检测所述第一防护策略的防护性能，包括：
统计预定时间间隔内向服务器发送的HTTP请求的数量，当向服务器发送的HTTP请求的数量大于第一阈值时，确定所述第一防护策略的防护性能不满足要求。
可选的，检测所述第一防护策略的防护性能，包括：
统计预定时间间隔内向服务器发送的HTTP请求的流量，当向服务器发送的HTTP请求的流量大于预设流量时，确定所述第一防护策略的防护性能不满足要求。
可选的，检测所述第一防护策略的防护性能，包括：
按照预设周期向服务器发送检测信息，当在预设时间段内没有接收到所述服务器基于所述检测信息发送的响应信息时，确定所述第一防护策略的防护性能不满足要求。
可选的，所述检测信息为预设的检测信息，所述按照预设周期向服务器发送预设的检测信息之后，还包括：
当所述服务器处于服务状态时，所述服务器接收到所述预设的检测信息后，获取预存的响应信息；
向所述防护设备发送所述响应信息。
可选的，所述按照预设周期向服务器发送检测信息，还包括：
按照预设周期将目标HTTP请求的源地址更换为防护设备的IP地址，得到携带有所述防护设备的IP地址的检测信息，所述目标HTTP请求为客户端发送的HTTP请求中的任意一个经过验证的请求；
向所述服务器发送所述检测信息。
可选的，向所述服务器发送所述检测信息之后，包括：
当接收到所述服务器基于所述检测信息发送的响应信息时，将所述响应信息中的目的地址更换为所述目标HTTP请求中的源地址；
发送更换目的地址后的所述响应信息。
可选的，所述方法还包括：
统计每个预定时间间隔内接收到的HTTP请求的数量；
当所述预定时间间隔内接收到的HTTP请求的数量大于第二阈值时，使用所述第一防护策略进行防护；
当连续预设数量的预定时间间隔内接收到的HTTP请求的数量均不大于第二阈值时，停止防护。
第二方面，提供了一种针对HTTP Flood攻击的防护装置，所述装置包括：
检测单元，用于当使用第一防护策略进行防护时，检测所述第一防护策略的防护性能；
防护单元，用于当所述第一防护策略的防护性能不满足要求时，使用第二防护策略进行防护，所述第二防护策略的防护等级高于所述第一防护策略的防护等级。
可选的，所述检测单元，具体用于统计预定时间间隔内向服务器发送的HTTP请求的数量，
所述防护单元，具体用于当向服务器发送的HTTP请求的数量大于第一阈值时，确定所述第一防护策略的防护性能不满足要求。
可选的，所述检测单元，还用于统计预定时间间隔内向服务器发送的HTTP请求的流量；
所述防护单元，还用于当向服务器发送的HTTP请求的流量大于预设流量时，确定所述第一防护策略的防护性能不满足要求。
可选的，所述检测单元，还用于按照预设周期向服务器发送检测信息；
所述防护单元，还用于当在预设时间段内没有接收到所述服务器基于所述检测信息发送的响应信息时，确定所述第一防护策略的防护性能不满足要求。
可选的，所述检测信息为预设的检测信息；
所述检测单元，还用于当所述服务器处于服务状态时，接收所述服务器基于所述预设的检测信息发送的预存的响应信息。
可选的，所述检测单元，还用于按照预设周期将目标HTTP请求的源地址更换为防护设备的IP地址，得到携带有所述防护设备的IP地址的检测信息，所述目标HTTP请求为客户端发送的HTTP请求中的任意一个经过验证的请求； 向所述服务器发送所述检测信息。
可选的，所述检测单元，还用于当接收到所述服务器基于所述检测信息发送的响应信息时，将所述响应信息中的目的地址更换为所述目标HTTP请求中的源地址；发送更换目的地址后的所述响应信息。
可选的，所述防护单元，还用于统计每个预定时间间隔内接收到的HTTP请求的数量；当所述预定时间间隔内接收到的HTTP请求的数量大于第二阈值时，使用所述第一防护策略进行防护；当连续预设数量的预定时间间隔内接收到的HTTP请求的数量均不大于第二阈值时，停止防护。
第三方面，提供了一种防护设备，所述防护设备包括处理器和存储器，所述存储器中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或指令集由所述处理器加载并执行以实现第一方面所述的防护方法。
本发明实施例提供的针对HTTP Flood攻击的防护方法及装置，能够自动的对攻击方式及防护效果进行检测，并针对不同的攻击方式对使用的防护策略进行自动调整，既能够提升防护效果，又能够较大程度地降低对用户正常使用的影响，并且及时性好。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1是本发明实施例提供的一种系统框架示意图；
图2是本发明实施例提供的一种针对HTTP Flood攻击的防护方法流程图；
图3是本发明实施例提供的另一种针对HTTP Flood攻击的防护方法流程图；
图4是本发明实施例提供的一种针对HTTP Flood攻击的防护装置的结构示意图；
图5是为本发明实施例提供的一种防护设备的结构示意图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
本发明实施例提供了一种针对HTTP Flood攻击的防护方法，该方法可以应用于图1所示的系统框架中。该系统框架包括客户端、防护设备以及服务器。客户端连接防护设备，防护设备连接服务器。客户端包括正常客户端以及攻击端。该服务器可以为服务器集群。防护设备接收并验证客户端向服务器发送的HTTP请求，对恶意请求进行防护和过滤，正常的请求被转发到服务器。
当不存在攻击时，防护设备可以不进行防护，也就是说，接收到的HTTP请求之后，无需验证该HTTP请求的安全性，而是直接向服务器发送该HTTP请求。防护设备确定是否存在攻击的过程为，确定每个预定时间间隔(例如，5秒)内接收到的HTTP请求的数量，当任一预定时间间隔内接收到的HTTP请求的数量超过阈值，即第二阈值时，可以认为存在攻击，否则可以认为不存在攻击。需要说明的是，每个预定时间间隔在时间上可以是连续的，也就是说上个预定时间间隔的结束时刻为下个预定时间间隔的起始时刻，每个预定时间间隔在时间上也可以是不连续的。
当存在攻击时，防护设备开始进行防护。防护设备进行防护的过程包括：接收客户端发送的HTTP请求，解析接收到的HTTP请求，当HTTP请求中不包含验证信息时，向该客户端发送用于获得验证信息的数据，客户端接收到该数据后再获得该数据对应的验证信息，重新向防护设备发送包含验证信息的HTTP请求，防护设备接收到HTTP请求后，解析出HTTP请求中的验证信息并进行验证，当验证通过后向服务器发送该HTTP请求。而攻击端在攻击服务器时，一般只负责发送大量的HTTP请求，而不会接收防护设备发送的验证信息或者接收后不做解析，从而无法发送新的带有验证信息的HTTP请求，没有通过防护设备验证的HTTP请求即为攻击端发送的恶意请求，将被丢弃而不会转发给服务器，通过防护设备验证的HTTP请求为正常的请求，将通过防护设备转发给服务器，因此防护设备能够拦截攻击端发送的HTTP请求，避免攻击端的恶意请求对服务器造成影响。
防护设备中存储有防护策略集合，所述防护策略集合中包括至少两种防护等级的防护策略，例如302跳转验证的防护策略，javascript脚本验证的防护策 略或图片验证的防护策略。在具体实施中，可以根据攻击端破解防护策略的难易程度对防护策略划分防护等级。例如，对于302跳转验证的防护策略，防护设备发送的数据中携带有验证信息，所以可以直接从该数据中获取到验证信息，而对于javascript脚本验证的防护策略，需要根据脚本中的程序进行相应计算才能生成验证信息，攻击端更不容易破解javascript脚本验证的防护策略，javascript脚本验证的防护策略的防护等级高于302跳转验证的防护策略的防护等级。对于图片验证的防护策略，需要用户根据图片输入验证信息，其防护等级更高。
当防护设备由不防护状态进入防护状态时，可以使用默认防护策略进行保护，例如使用防护等级最低的防护策略。当使用当前防护策略进行防护时，服务器仍受到攻击，则可以采用比当前防护等级更高的防护策略进行防护，以下对该过程进行详细说明。
参见图2，为本发明实施例提供的一种针对HTTP Flood攻击的防护方法的流程图，该方法具体应用于防护设备中，也即由防护设备来执行，该方法可以包括以下步骤。
步骤201，当使用第一防护策略进行防护时，检测所述第一防护策略的防护性能。
所述第一防护策略可以为防护策略集合中的任一防护策略。
步骤202，当所述第一防护策略的防护性能不满足要求时，使用第二防护策略进行防护，所述第二防护策略的防护等级高于所述第一防护策略的防护等级。
当存在攻击时，也就是说当防护设备开始进行防护时，可以检测当前使用的第一防护策略的防护性能，或者说是防护效果，当所述第一防护策略的防护性能不满足要求时，改用防护等级更高的防护策略进行防护，从而实现对防护策略的自动调整。
本发明实施例提供了两种检测所述第一防护策略的防护性能的方式。
检测方式一，统计预定时间间隔内向服务器发送的HTTP请求的数量或流量。
攻击端在进行攻击服务器时，会发送大量的恶意请求，当当前使用的防护策略对于当前的恶意攻击的防护性能较差时，不能检测出这些恶意请求，误将其认为合法的HTTP请求，而将大量的恶意请求转发给服务器。所以当检测到 预定时间间隔内向服务器发送的HTTP请求的数量大于第一阈值时，或者向服务器发送的HTTP请求的流量大于预设流量时，可以确定当前使用的防护策略的防护性能较差，不满足要求，此时需要使用较当前使用的防护策略防护等级更高的防护策略进行防护。
检测方式二，按照预设周期向服务器发送检测信息，当在预设时间段内没有接收到所述服务器基于所述检测信息发送的响应信息时，确定所述第一防护策略的防护性能不满足要求。
在具体实施中，防护设备可以同时采用检测方式一和检测方式二进行防护，或者单独采用其中一种检测方式进行防护。
在本发明实施例中，可以多次升级所使用的防护策略。也就是说，每当发现当前使用的防护策略的防护性能不满足要求时即可对防护策略进行升级。例如，当前使用的防护策略为302跳转验证的防护策略，当升级后，可以使用javascript脚本验证的防护策略。一旦发现使用javascript脚本验证的防护策略时，服务器仍收到了攻击，则继续升级，改用图片验证的防护策略进行防护。防护策略集合中的各个防护策略可以按照防护等级的高低进行排序，当每进行防护策略的升级时，可以使用比当前防护策略高一级的防护策略。如果当前所使用的防护策略为最高防护等级，可以继续检测服务器的服务状态，当检测到服务器没有处于服务状态，说明最高防护等级的防护策略也无法防护当前的攻击，继而可以进一步提升防护策略的防护等级。
防护设备在进行防护时，可以统计每个预定时间间隔内接收到的HTTP请求的数量，当连续预设数量的预定时间间隔内接收到的HTTP请求的数量均不大于第二阈值时，说明已不存在攻击，可以停止防护。本发明实施例中的第一阈值与第二阈值可以相等，也可以不等，在此不做具体限定。
以下，对检测方式二进行详细说明。
参见图3，为本发明实施例提供的一种针对HTTP Flood攻击的防护方法的流程图，该方法具体应用于防护设备中，也即由防护设备来执行，该方法可以包括以下步骤。
步骤301，防护设备使用第一防护策略进行防护，并按照预设周期向服务器发送检测信息。
当存在攻击时，也就是说当防护设备开始进行防护时，可以按照预设周期向服务器发送检测信息，检测服务器是否处于服务状态，根据服务器的服务状态来判断当前防护策略针对当前攻击的防护效果。当防护设备处于防护状态时，可以持续检测服务器的服务状态，直至停止防护。
步骤302，当在预设时间段内没有接收到所述服务器基于所述检测信息发送的响应信息时，所述防护设备使用第二防护策略进行防护，所述第二防护策略的防护等级高于所述第一防护策略的防护等级。
当服务器处于服务状态时，服务器可以接收到防护设备发来的检测信息，并根据该检测信息向防护设备发送响应信息；而当服务器受到攻击而没有处于服务状态时，服务器则无法接收到的防护设备发来的检测信息，或者无法根据该检测信息向防护设备发送响应信息，防护设备也就无法接收到响应信息。防护设备没有接收到响应信息包括没有接收到任何信息的情况，也包括接收到提示错误的信息的情况。
防护设备可以采用两种实施方式向服务器发送的检测信息，以下进行分别介绍。
实施方式一
所述防护设备按照预设周期向服务器发送预设的检测信息，也就是说，防护设备每次发送的检测信息都相同。该预设的检测信息可以为完整的HTTP请求，也可以只包括HTTP请求中的请求头部，使用的检测信息只要能够被服务器识别即可，此处不对检测信息的格式进行具体限定。服务器中预存有检测信息对应的响应信息。也就是说该检测信息对应一个固定的页面，并且可以使用固定的域名来访问该页面。
当服务器处于服务状态时，所述服务器接收到所述预设的检测信息后，获取预存的响应信息，再向所述防护设备发送所述响应信息。防护设备接收到该响应信息后，可以确定服务器处于正常服务状态。当在预设时间段内没有接收到所述服务器基于所述检测信息发送的响应信息时，可以确定服务器没有处于服务状态，即可将当前防护策略升级到更高等级的防护策略。
需要说明的是，服务器中也可以不预存有检测信息对应的响应信息，并且检测信息可以为完整的HTTP请求，服务器可以基于该HTTP请求进行正常的响应服务，从而向防护设备发送响应信息。该响应服务类似于基于客户端发送 的HTTP请求进行的响应服务。
实施方式二
所述防护设备按照预设周期将目标HTTP请求的源地址更换为防护设备的互联网协议(Internet Protocol，IP)地址，并将携带有防护设备IP地址的HTTP请求作为检测信息，所述目标HTTP请求为客户端发送的HTTP请求中的任意一个经过验证的请求。所述防护设备再向服务器发送所述检测信息。服务器可以根据该HTTP请求进行正常响应服务，并向防护设备发送响应信息。当接收到所述服务器基于所述检测信息发送的响应信息时，说明服务器处于服务状态，所述防护设备将所述响应信息中的目的地址更换为所述目标HTTP请求中的源地址，并发送更换目的地址后的所述响应信息。
该实施方式将客户端发送的HTTP请求通过更换源地址后作为检测信息，使服务器根据该检测信息向防护设备发送响应信息，防护设备接收到响应信息后，再更换目标地址，以使该客户端接收到响应信息，这样即能够检测服务器是否处于服务状态，又不影响客户端的正常访问，也不会因为周期性地发送额外的检测信息，而增加服务器的负担。
本发明实施例提供的针对HTTP Flood攻击的防护方法，能够自动的对攻击方式及防护效果进行检测，并能够针对不同的攻击方式对使用的防护策略进行自动调整，即默认使用防护等级较低的防护策略进行防护，当检测到当前防护策略不足以防护当前的攻击，致使防护效果不佳时，将自适应将当前防护策略升级到较高等级的防护策略，直至能够抵挡当前的攻击。如此，既能够提升防护效果，又能够较大程度地降低对用户正常使用的影响，并且及时性好。
参见图4，为本发明实施例提供的一种针对HTTP Flood攻击的防护装置的结构示意图，该装置可以配置于防护设备中，或者为防护设备本身。该装置可以包括检测单元401和防护单元402。
其中，检测单元401，用于当使用第一防护策略进行防护时，检测所述第一防护策略的防护性能。
防护单元402，用于当所述第一防护策略的防护性能不满足要求时，使用第二防护策略进行防护，所述第二防护策略的防护等级高于所述第一防护策略的防护等级。
优选地，所述检测单元401，具体用于统计预定时间间隔内向服务器发送的HTTP请求的数量；所述防护单元402，具体用于当向服务器发送的HTTP请求的数量大于第一阈值时，确定所述第一防护策略的防护性能不满足要求。
优选地，所述检测单元401，还用于统计预定时间间隔内向服务器发送的HTTP请求的流量；所述防护单元402，还用于当向服务器发送的HTTP请求的流量大于预设流量时，确定所述第一防护策略的防护性能不满足要求。
优选地，所述检测单元401，还用于按照预设周期向服务器发送检测信息；所述防护单元402，还用于当在预设时间段内没有接收到所述服务器基于所述检测信息发送的响应信息时，确定所述第一防护策略的防护性能不满足要求。
优选地，所述检测信息为预设的检测信息；所述检测单元401，还用于当所述服务器处于服务状态时，接收所述服务器基于所述预设的检测信息发送的预存的响应信息。
优选地，所述检测单元401，还用于按照预设周期将目标HTTP请求的源地址更换为防护设备的IP地址，得到携带有所述防护设备的IP地址的检测信息，所述目标HTTP请求为客户端发送的HTTP请求中的任意一个经过验证的请求；向所述服务器发送所述检测信息。
优选地，所述检测单元401，还用于当接收到所述服务器基于所述检测信息发送的响应信息时，将所述响应信息中的目的地址更换为所述目标HTTP请求中的源地址；发送更换目的地址后的所述响应信息。
优选地，所述防护单元402，还用于统计每个预定时间间隔内接收到的HTTP请求的数量；当连续预设数量的预定时间间隔内接收到的HTTP请求的数量均不大于第二阈值时，停止防护。
优选地，所述防护单元402，还用于统计预定时间间隔内接收到的HTTP请求的数量；当所述预定时间间隔内接收到的HTTP请求的数量大于第二阈值时，使用所述第一防护策略进行防护。
本发明实施例提供的针对HTTP Flood攻击的防护装置，能够自动的对攻击方式及防护效果进行检测，并针对不同的攻击方式对使用的防护策略进行自动调整，既能够提升防护效果，又能够较大程度地降低对用户正常使用的影响，并且及时性好。
需要说明的是：上述实施例提供的针对HTTP Flood攻击的防护装置在进行防护时，仅以上述各功能单元的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能单元完成，即将装置的内部结构划分成不同的功能单元，以完成以上描述的全部或者部分功能。另外，上述实施例提供的针对HTTP Flood攻击的防护装置与针对HTTP Flood攻击的防护方法的实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
参见图5，为本发明实施例提供的防护设备的结构示意图。该防护设备500可因配置或性能不同而产生比较大的差异，可以包括一个或一个以上中央处理器522(例如，一个或一个以上处理器)和存储器532，一个或一个以上存储应用程序542或数据544的存储介质530(例如一个或一个以上海量存储设备)。其中，存储器532和存储介质530可以是短暂存储或持久存储。存储在存储介质530的程序可以包括一个或一个以上单元(图示没标出)，每个单元可以包括对防护设备中的一系列指令操作。更进一步地，中央处理器522可以设置为与存储介质530通信，在防护设备500上执行存储介质530中的一系列指令操作。
防护设备500还可以包括一个或一个以上电源529，一个或一个以上有线或无线网络接口550，一个或一个以上输入输出接口558，一个或一个以上键盘554，和/或，一个或一个以上操作系统541，例如Windows ServerTM，Mac OS XTM，UnixTM，LinuxTM，FreeBSDTM等等。
防护设备500可以包括有存储器，以及一个或者一个以上的程序，其中一个或者一个以上程序存储于存储器中，且经配置以由一个或者一个以上处理器执行所述一个或者一个以上程序包含用于进行上述防护方法的指令。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述仅为本发明的较佳实施例，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (17)

  1. 一种针对HTTP Flood攻击的防护方法，其特征在于，所述方法应用于防护设备中，所述方法包括：
    当使用第一防护策略进行防护时，检测所述第一防护策略的防护性能；
    当所述第一防护策略的防护性能不满足要求时，使用第二防护策略进行防护，所述第二防护策略的防护等级高于所述第一防护策略的防护等级。
  2. 根据权利要求1所述的方法，其特征在于，所述检测所述第一防护策略的防护性能，包括：
    统计预定时间间隔内向服务器发送的HTTP请求的数量，当向服务器发送的HTTP请求的数量大于第一阈值时，确定所述第一防护策略的防护性能不满足要求。
  3. 根据权利要求1所述的方法，其特征在于，所述检测所述第一防护策略的防护性能，包括：
    统计预定时间间隔内向服务器发送的HTTP请求的流量，当向服务器发送的HTTP请求的流量大于预设流量时，确定所述第一防护策略的防护性能不满足要求。
  4. 根据权利要求1所述的方法，其特征在于，所述检测所述第一防护策略的防护性能，包括：
    按照预设周期向服务器发送检测信息，当在预设时间段内没有接收到所述服务器基于所述检测信息发送的响应信息时，确定所述第一防护策略的防护性能不满足要求。
  5. 根据权利要求4所述的方法，其特征在于，所述检测信息为预设的检测信息，所述按照预设周期向服务器发送预设的检测信息之后，还包括：
    当所述服务器处于服务状态时，所述服务器接收到所述预设的检测信息后，获取预存的响应信息；
    向所述防护设备发送所述响应信息。
  6. 根据权利要求4所述的方法，其特征在于，所述按照预设周期向服务器发送检测信息，还包括：
    按照预设周期将目标HTTP请求的源地址更换为防护设备的IP地址，得到 携带有所述防护设备的IP地址的检测信息，所述目标HTTP请求为客户端发送的HTTP请求中的任意一个经过验证的请求；
    向所述服务器发送所述检测信息。
  7. 根据权利要求6所述的方法，其特征在于，向所述服务器发送所述检测信息之后，包括：
    当接收到所述服务器基于所述检测信息发送的响应信息时，将所述响应信息中的目的地址更换为所述目标HTTP请求中的源地址；
    发送更换目的地址后的所述响应信息。
  8. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    统计每个预定时间间隔内接收到的HTTP请求的数量；
    当所述预定时间间隔内接收到的HTTP请求的数量大于第二阈值时，使用所述第一防护策略进行防护；
    当连续预设数量的预定时间间隔内接收到的HTTP请求的数量均不大于第二阈值时，停止防护。
  9. 一种针对HTTP Flood攻击的防护装置，其特征在于，所述装置包括：
    检测单元，用于当使用第一防护策略进行防护时，检测所述第一防护策略的防护性能；
    防护单元，用于当所述第一防护策略的防护性能不满足要求时，使用第二防护策略进行防护，所述第二防护策略的防护等级高于所述第一防护策略的防护等级。
  10. 根据权利要求9所述的装置，其特征在于，
    所述检测单元，具体用于统计预定时间间隔内向服务器发送的HTTP请求的数量；
    所述防护单元，具体用于当向服务器发送的HTTP请求的数量大于第一阈值时，确定所述第一防护策略的防护性能不满足要求。
  11. 根据权利要求9所述的装置，其特征在于，
    所述检测单元，还用于统计预定时间间隔内向服务器发送的HTTP请求的流量；
    所述防护单元，还用于当向服务器发送的HTTP请求的流量大于预设流量 时，确定所述第一防护策略的防护性能不满足要求。
  12. 根据权利要求9所述的装置，其特征在于，
    所述检测单元，还用于按照预设周期向服务器发送检测信息；
    所述防护单元，还用于当在预设时间段内没有接收到所述服务器基于所述检测信息发送的响应信息时，确定所述第一防护策略的防护性能不满足要求。
  13. 根据权利要求12所述的装置，其特征在于，所述检测信息为预设的检测信息；
    所述检测单元，还用于当所述服务器处于服务状态时，接收所述服务器基于所述预设的检测信息发送的预存的响应信息。
  14. 根据权利要求12所述的装置，其特征在于，
    所述检测单元，还用于按照预设周期将目标HTTP请求的源地址更换为防护设备的IP地址，得到携带有所述防护设备的IP地址的检测信息，所述目标HTTP请求为客户端发送的HTTP请求中的任意一个经过验证的请求；向所述服务器发送所述检测信息。
  15. 根据权利要求14所述的装置，其特征在于，
    所述检测单元，还用于当接收到所述服务器基于所述检测信息发送的响应信息时，将所述响应信息中的目的地址更换为所述目标HTTP请求中的源地址；发送更换目的地址后的所述响应信息。
  16. 根据权利要求9所述的装置，其特征在于，
    所述防护单元，还用于统计每个预定时间间隔内接收到的HTTP请求的数量；
    当所述预定时间间隔内接收到的HTTP请求的数量大于第二阈值时，使用所述第一防护策略进行防护；
    当连续预设数量的预定时间间隔内接收到的HTTP请求的数量均不大于第二阈值时，停止防护。
  17. 一种防护设备，其特征在于，所述防护设备包括处理器和存储器，所述存储器中存储有至少一条指令、至少一段程序、代码集或指令集，所述至少一条指令、所述至少一段程序、所述代码集或指令集由所述处理器加载并执行以实现如权利要求1至8任一所述的针对HTTP Flood攻击的防护方法。
PCT/CN2018/095433 2018-06-19 2018-07-12 一种针对HTTP Flood攻击的防护方法及装置 WO2019242052A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP18877315.4A EP3618395B1 (en) 2018-06-19 2018-07-12 Method and device for protecting against http flood attack
US16/340,826 US20210367967A1 (en) 2018-06-19 2018-07-12 A method and apparatus for defending an http flood attack

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810631486.7A CN108429772A (zh) 2018-06-19 2018-06-19 一种针对HTTP Flood攻击的防护方法及装置
CN201810631486.7 2018-06-19

Publications (1)

Publication Number Publication Date
WO2019242052A1 true WO2019242052A1 (zh) 2019-12-26

Family

ID=63164660

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/095433 WO2019242052A1 (zh) 2018-06-19 2018-07-12 一种针对HTTP Flood攻击的防护方法及装置

Country Status (4)

Country Link
US (1) US20210367967A1 (zh)
EP (1) EP3618395B1 (zh)
CN (1) CN108429772A (zh)
WO (1) WO2019242052A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116165522A (zh) * 2023-04-26 2023-05-26 长鑫存储技术有限公司 行锤保护电路的性能验证方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080086434A1 (en) * 2006-10-09 2008-04-10 Radware, Ltd. Adaptive Behavioral HTTP Flood Protection
CN105306411A (zh) * 2014-06-11 2016-02-03 腾讯科技（深圳）有限公司 数据包处理方法和装置
CN105656843A (zh) * 2014-11-11 2016-06-08 腾讯数码（天津）有限公司 基于验证的应用层防护方法、装置及网络设备
CN105939201A (zh) * 2015-07-13 2016-09-14 杭州迪普科技有限公司 服务器状态的检查方法和装置
CN106789983A (zh) * 2016-12-08 2017-05-31 北京安普诺信息技术有限公司 一种cc攻击防御方法及其防御系统
CN107171885A (zh) * 2017-03-31 2017-09-15 北京奇艺世纪科技有限公司 一种检测服务器运行状态的方法、装置和系统

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7624084B2 (en) * 2006-10-09 2009-11-24 Radware, Ltd. Method of generating anomaly pattern for HTTP flood protection

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080086434A1 (en) * 2006-10-09 2008-04-10 Radware, Ltd. Adaptive Behavioral HTTP Flood Protection
CN105306411A (zh) * 2014-06-11 2016-02-03 腾讯科技（深圳）有限公司 数据包处理方法和装置
CN105656843A (zh) * 2014-11-11 2016-06-08 腾讯数码（天津）有限公司 基于验证的应用层防护方法、装置及网络设备
CN105939201A (zh) * 2015-07-13 2016-09-14 杭州迪普科技有限公司 服务器状态的检查方法和装置
CN106789983A (zh) * 2016-12-08 2017-05-31 北京安普诺信息技术有限公司 一种cc攻击防御方法及其防御系统
CN107171885A (zh) * 2017-03-31 2017-09-15 北京奇艺世纪科技有限公司 一种检测服务器运行状态的方法、装置和系统

Also Published As

Publication number Publication date
EP3618395A4 (en) 2020-03-04
EP3618395B1 (en) 2020-12-30
EP3618395A1 (en) 2020-03-04
US20210367967A1 (en) 2021-11-25
CN108429772A (zh) 2018-08-21

Similar Documents

Publication Publication Date Title
US11546349B2 (en) Authenticating access configuration for application programming interfaces
US10623376B2 (en) Qualifying client behavior to mitigate attacks on a host
US11019383B2 (en) Internet anti-attack method and authentication server
KR101669694B1 (ko) 네트워크 자원들에 대한 건강 기반 액세스
US9436820B1 (en) Controlling access to resources in a network
CN108463980B (zh) 用于提供网络安全性的方法和系统
US20060282893A1 (en) Network information security zone joint defense system
US10855719B2 (en) Automated DDOS attack mitigation via BGP messaging
CN109688153B (zh) 使用主机应用/程序到用户代理的映射的零日威胁检测
US20110023088A1 (en) Flow-based dynamic access control system and method
KR100973076B1 (ko) 분산 서비스 거부 공격 대응 시스템 및 그 방법
US20210203635A1 (en) System and method for automatic waf service configuration
US11855964B1 (en) Blocking download of content
CN106790149A (zh) 一种防御IoT设备遭受入侵的方法及系统
US9380067B2 (en) IPS detection processing method, network security device, and system
WO2019242052A1 (zh) 一种针对HTTP Flood攻击的防护方法及装置
KR101022508B1 (ko) 서비스 거부 공격 및 분산 서비스 공격 차단 시스템
JP2017117224A (ja) ネットワークセキュリティ装置、セキュリティシステム、ネットワークセキュリティ方法、及びプログラム
WO2019242053A1 (zh) 一种针对HTTP Flood攻击的防护方法及系统
CN105656927B (zh) 一种安全访问方法及系统
KR20120000942A (ko) 블랙리스트 접근 통계 기반의 봇 감염 호스트 탐지 장치 및 그 탐지 방법
JP2002158660A (ja) 不正アクセス防御システム
KR20110006398A (ko) 디도스 공격 감지 및 방어방법
JP6101525B2 (ja) 通信制御装置、通信制御方法、通信制御プログラム
KR101137828B1 (ko) 서비스 거부 공격을 방어하기 위한 방법, 시스템 및 컴퓨터 판독 가능한 기록 매체

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2018877315

Country of ref document: EP

Effective date: 20190524

NENP Non-entry into the national phase

Ref country code: DE